Coder Social home page Coder Social logo

amzn / zeek-plugin-profinet Goto Github PK

View Code? Open in Web Editor NEW
26.0 11.0 18.0 25 KB

Zeek network security monitor plugin that enables parsing of the Profinet protocol

License: BSD 3-Clause "New" or "Revised" License

CMake 1.24% Dockerfile 5.45% Makefile 2.58% Shell 1.26% Zeek 50.75% C++ 8.95% JavaScript 29.76%

zeek-plugin-profinet's Introduction

Zeek Plugin PROFINET

When running as part of your Zeek installation this plugin will produce two log files containing metadata extracted from any PROFINET traffic observed on UDP port 34964.

Installation and Usage

zeek-plugin-profinet is distributed as a Zeek package and is compatible with the zkg command line tool.

Sharing and Contributing

This code is made available under the BSD-3-Clause license. Guidelines for contributing are available as well as a pull request template. A Dockerfile has been included in the repository to assist with setting up an environment for testing any changes to the plugin.

zeek-plugin-profinet's People

Contributors

ckreibich avatar jamesiri avatar mdudek-ics avatar mmguero avatar nothinrandom avatar voteblake avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

zeek-plugin-profinet's Issues

Can't install zeek-plugin-profinet in Zeek version 5.0.3

I'm using zeek 5.0.3, and zkg 2.13.0
I install by running the cmd: zkg install --force --skiptests zeek-plugin-profinet, then get the error message:

Installing "zeek/amzn/zeek-plugin-profinet"..
Failed installing "zeek/amzn/zeek-plugin-profinet": package build_command failed, see log in /root/.zkg/logs/zeek-plugin-profinet-build.log
error: incomplete installation, the follow packages failed to be installed:
  zeek/amzn/zeek-plugin-profinet (1.1.0)

The content of /root/.zkg/logs/zeek-plugin-profinet-build.log:

=== STDERR ===
CMake Warning:
  Manually-specified variables were not used by the project:

    CAF_ROOT_DIR


make: [Makefile:12: build-it] Error 1 (ignored)
/root/.zkg/clones/package/zeek-plugin-profinet/src/profinet.pac:1: error: cannot include file "binpac.pac"
/root/.zkg/clones/package/zeek-plugin-profinet/src/profinet.pac:2: error: cannot include file "bro.pac"
In file included from /root/.zkg/clones/package/zeek-plugin-profinet/src/PROFINET.cc:1:
/root/.zkg/clones/package/zeek-plugin-profinet/src/PROFINET.h:5:10: fatal error: analyzer/protocol/udp/UDP.h: No such file or directory
    5 | #include "analyzer/protocol/udp/UDP.h"
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
compilation terminated.
make[3]: *** [CMakeFiles/Zeek-Profinet.linux-x86_64.dir/build.make:91: CMakeFiles/Zeek-Profinet.linux-x86_64.dir/src/PROFINET.cc.o] Error 1
make[2]: *** [CMakeFiles/Makefile2:197: CMakeFiles/Zeek-Profinet.linux-x86_64.dir/all] Error 2
make[1]: *** [Makefile:141: all] Error 2
make: *** [Makefile:13: build-it] Error 2
=== STDOUT ===
Build Directory        : build
Zeek Source Directory   : 
-- The C compiler identification is GNU 9.4.0
-- The CXX compiler identification is GNU 9.4.0
-- Check for working C compiler: /usr/bin/cc
-- Check for working C compiler: /usr/bin/cc -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Detecting C compile features
-- Detecting C compile features - done
-- Check for working CXX compiler: /usr/bin/c++
-- Check for working CXX compiler: /usr/bin/c++ -- works
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Detecting CXX compile features
-- Detecting CXX compile features - done
-- Performing Test cxx17_already_works
-- Performing Test cxx17_already_works - Failed
-- Performing Test cxx17_works
-- Performing Test cxx17_works - Success
-- Found BinPAC: /opt/zeek/bin/binpac  
-- Found Broker: /opt/zeek/lib/libbroker.a  
-- Zeek executable      : /opt/zeek/bin/zeek
-- Zeek source          : 
-- Zeek build           : 
-- Zeek install prefix  : /opt/zeek
-- Zeek plugin directory: /opt/zeek/lib/zeek/plugins
-- Zeek debug mode      : 
-- Zeek unittest support: no
-- Configuring done
-- Generating done
-- Build files have been written to: /root/.zkg/clones/package/zeek-plugin-profinet/build
( cd build && make )
make[1]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[2]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
Scanning dependencies of target pac-profinet.pac
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
[  7%] [BINPAC] Processing src/profinet.pac
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
[  7%] Built target pac-profinet.pac
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
Scanning dependencies of target generate_outputs
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
[  7%] Built target generate_outputs
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
Scanning dependencies of target bif-plugin-Zeek_Profinet-events.bif
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
[ 15%] [BIFCL] Processing src/events.bif
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
[ 15%] Built target bif-plugin-Zeek_Profinet-events.bif
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
Scanning dependencies of target bro-plugin-Zeek_Profinet
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
[ 23%] Creating __bro_plugin__ for Zeek::Profinet
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
[ 23%] Built target bro-plugin-Zeek_Profinet
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
Scanning dependencies of target bif-init-Zeek_Profinet
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
[ 23%] Built target bif-init-Zeek_Profinet
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
Scanning dependencies of target copy-scripts-Zeek_Profinet
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
[ 23%] Built target copy-scripts-Zeek_Profinet
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
Scanning dependencies of target Zeek-Profinet.linux-x86_64
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[3]: Entering directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
[ 30%] Building CXX object CMakeFiles/Zeek-Profinet.linux-x86_64.dir/src/PROFINET.cc.o
make[3]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[2]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'
make[1]: Leaving directory '/root/.zkg/clones/package/zeek-plugin-profinet/build'

Does not install with Zeek v6.0.0

Installing:

zkg -vvv install zeek-plugin-profinet
2023-09-06 13:26:39 DEBUG    init Manager version 2.14.0
2023-09-06 13:26:39 DEBUG    found source clone of "zeek" at /opt/zeek/var/lib/zkg/clones/source/zeek
2023-09-06 13:26:39 DEBUG    getting info on "zeek-plugin-profinet"
2023-09-06 13:26:40 DEBUG    checked out "zeek/amzn/zeek-plugin-profinet", branch/version "1.1.0"
2023-09-06 13:26:40 DEBUG    getting info on "zeek/amzn/zeek-plugin-profinet"
2023-09-06 13:26:41 DEBUG    checked out "zeek/amzn/zeek-plugin-profinet", branch/version "1.1.0"
The following packages will be INSTALLED:
  zeek/amzn/zeek-plugin-profinet (1.1.0)

Proceed? [Y/n] y
2023-09-06 13:26:42 INFO     Skipping unit tests for "zeek/amzn/zeek-plugin-profinet": no test_command in metadata
2023-09-06 13:26:42 DEBUG    installing "zeek/amzn/zeek-plugin-profinet"
Installing "zeek/amzn/zeek-plugin-profinet"2023-09-06 13:26:42 DEBUG    staging "zeek/amzn/zeek-plugin-profinet": version 1.1.0
2023-09-06 13:26:42 DEBUG    building "zeek/amzn/zeek-plugin-profinet": running build_command: ./configure && make
2023-09-06 13:26:42 INFO     installing "zeek/amzn/zeek-plugin-profinet": writing build log: /opt/zeek/var/lib/zkg/logs/zeek-plugin-profinet-build.log
.
Failed installing "zeek/amzn/zeek-plugin-profinet": package build_command failed, see log in /opt/zeek/var/lib/zkg/logs/zeek-plugin-profinet-build.log
error: incomplete installation, the follow packages failed to be installed:
  zeek/amzn/zeek-plugin-profinet (1.1.0)

Looking at the build.log:

=== STDERR ===
Usage: zeek-config [OPTIONS]

Basic options:

  --build_type          Zeek build type as per cmake, lower case (e.g. 'relwithdebinfo')
  --prefix              Toplevel Zeek distribution installation directory
  --version             Zeek version number
  --zeek_dist           Toplevel directory of source tree the distribution built from
  --zeekpath            ZEEKPATH environment variable paths for this distribution

Specific directories in the Zeek distribution:

  --btest_tools_dir     Zeek-related BTest tooling
  --cmake_dir           Zeek's cmake modules
  --config_dir          Configuration files for cluster topology, zkg, etc
  --include_dir         C/C++ header folders for Zeek and related components, colon-separated
  --lib_dir             Toplevel folder for shared libraries, Python packages, etc
  --plugin_dir          Native-code Zeek plugins
  --python_dir          Python packages (Broker, ZeekControl, zkg, etc)
  --script_dir          Toplevel folder for Zeek scripts
  --site_dir            Site-specific Zeek scripts

Toplevel installation directories for third-party components:

  --binpac_root         BinPAC compiler
  --broker_root         Broker communication framework

Feature tests:

  --have-spicy-analyzers  Prints 'yes' if built-in Spicy analyzers are available; exit code reflects result

CMake Warning at /opt/zeek/share/zeek/cmake/ZeekPlugin.cmake:141 (message):
  Package requires CMake 3.0 which is less than Zeek's requirement (3.15.0).
  This will likely cause build failures and should be fixed.
Call Stack (most recent call first):
  CMakeLists.txt:6 (include)


CMake Warning (dev) at /opt/zeek/share/zeek/cmake/ZeekPlugin.cmake:120 (if):
  Policy CMP0057 is not set: Support new IN_LIST if() operator.  Run "cmake
  --help-policy CMP0057" for policy details.  Use the cmake_policy command to
  set the policy and suppress this warning.

  IN_LIST will be interpreted as an operator when the policy is set to NEW.
  Since the policy is not set the OLD behavior will be used.
Call Stack (most recent call first):
  /opt/zeek/share/zeek/cmake/ZeekPluginDynamic.cmake:77 (zeek_next_pac_block)
  /opt/zeek/share/zeek/cmake/ZeekPlugin.cmake:196 (zeek_add_dynamic_plugin)
  /opt/zeek/share/zeek/cmake/ZeekPluginCommon.cmake:68 (zeek_add_plugin)
  CMakeLists.txt:13 (zeek_plugin_end)
This warning is for project developers.  Use -Wno-dev to suppress it.

CMake Error at /opt/zeek/share/zeek/cmake/ZeekPlugin.cmake:120 (if):
  if given arguments:

    "arg" "IN_LIST" "separators"

  Unknown arguments specified
Call Stack (most recent call first):
  /opt/zeek/share/zeek/cmake/ZeekPluginDynamic.cmake:77 (zeek_next_pac_block)
  /opt/zeek/share/zeek/cmake/ZeekPlugin.cmake:196 (zeek_add_dynamic_plugin)
  /opt/zeek/share/zeek/cmake/ZeekPluginCommon.cmake:68 (zeek_add_plugin)
  CMakeLists.txt:13 (zeek_plugin_end)


=== STDOUT ===
Build Directory        : build
Zeek Source Directory   : 
-- The C compiler identification is GNU 12.2.0
-- The CXX compiler identification is GNU 12.2.0
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working C compiler: /usr/bin/cc - skipped
-- Detecting C compile features
-- Detecting C compile features - done
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Check for working CXX compiler: /usr/bin/c++ - skipped
-- Detecting CXX compile features
-- Detecting CXX compile features - done
-- Performing Test CMAKE_HAVE_LIBC_PTHREAD
-- Performing Test CMAKE_HAVE_LIBC_PTHREAD - Success
-- Found Threads: TRUE  
-- Found OpenSSL: /usr/lib/x86_64-linux-gnu/libcrypto.so (found version "3.0.9")  
-- Found BinPAC: /opt/zeek/bin/binpac  
-- Found BifCl at /opt/zeek/bin/bifcl
-- Setting plugin CMAKE_BUILD_TYPE to RelWithDebInfo
-- Configuring incomplete, errors occurred!
See also "/opt/zeek/var/lib/zkg/clones/package/zeek-plugin-profinet/build/CMakeFiles/CMakeOutput.log".

I know the CAF stuff is deprecated and should be removed. I'm testing a fix now (setting minimum cmake 3.15.

Clarify Extent of PROFINET Coverage to Expect

The README currently states to expect this plugin to emit logs for "any PROFINET traffic observed on UDP port 34964" (emphasis added). PROFINET is a family of protocols, only a subset of which use UDP. We should clarify here which set of PROFINET proticols we expect this to work on, and, if possible, which we test it on.

cc: @MDudek-ICS

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.